A third party scan found that the ConvertIssue.jspa action is vulnerable to content spoofing, in specific text injection. In this case the content spoofing may be used to perform a phishing attack on users.

How to reproduce:
https://jira.atlassian.com/secure/AddPortalPage!default.jspa?clonePageId=543%22You%20are%20seeing%20this%20error%20due%20to%20unauthenitcated/malicious%20activity%20from%20this%20account.%20To%20proceed%20please%20contact%20a%20Customer%20Service%20agent%20at(800)%20555-5555%20or%20email%20us%20at%20%22stealyourid@example.com&atl_token=ARL5-JM5F-FL1H-5Q9J%7C363acff80f4bb537d96e7be72241ecbc7e06b076%7Clin